[apparmor] [PATCH 4/4] Function to test if apparmor support is enabled.
John Johansen
john.johansen at canonical.com
Tue Jul 26 21:45:50 UTC 2011
Signed-off-by: John Johansen <john.johansen at canonical.com>
---
libraries/libapparmor/doc/aa_find_mountpoint.pod | 42 ++++++++++++++++++++
libraries/libapparmor/src/apparmor.h | 1 +
libraries/libapparmor/src/kernel_interface.c | 46 ++++++++++++++++++++++
libraries/libapparmor/src/libapparmor.map | 1 +
libraries/libapparmor/swig/SWIG/libapparmor.i | 1 +
5 files changed, 91 insertions(+), 0 deletions(-)
diff --git a/libraries/libapparmor/doc/aa_find_mountpoint.pod b/libraries/libapparmor/doc/aa_find_mountpoint.pod
index 28f25f4..98fa276 100644
--- a/libraries/libapparmor/doc/aa_find_mountpoint.pod
+++ b/libraries/libapparmor/doc/aa_find_mountpoint.pod
@@ -22,24 +22,36 @@
=head1 NAME
+aa_is_enabled - determine if apparmor is available
+
aa_find_mountpoint - find where the apparmor interface filesystem is mounted
=head1 SYNOPSIS
B<#include E<lt>sys/apparmor.hE<gt>>
+B<int aa_is_enabled(void);>
+
B<int aa_find_mountpoint(char **mnt);>
Link with B<-lapparmor> when compiling.
=head1 DESCRIPTION
+The aa_is_enabled function returns true (1) if apparmor is enabled. If it
+isn't it sets the errno to reflect the reason it is not enabled and returns 0.
+
The aa_find_mountpoint function finds where the apparmor filesystem is mounted
on the system, and returns a string containing the mount path. It is the
caller's responsibility to free(3) the returned path.
=head1 RETURN VALUE
+B<aa_is_enabled>
+On success 1 is returned. On error, 0 is returned, and errno(3) is set
+appropriately.
+
+B<aa_find_mountpoint>
On success zero is returned. On error, -1 is returned, and errno(3) is set
appropriately.
@@ -47,6 +59,36 @@ appropriately.
=over 4
+B<aa_is_enabled>
+
+=item B<ENOSYS>
+
+AppArmor extensions to the system are not available.
+
+=item B<ECANCELED>
+
+AppArmor is available on the system but has been disabled at boot.
+
+=item B<ENOENT>
+
+AppArmor is available (and maybe even enforcing policy) but the interface is
+not available.
+
+=item B<ENOMEM>
+
+Insufficient memory was available.
+
+=item B<EPERM>
+
+Did not have sufficient permissions to determine if AppArmor is enabled.
+
+=item B<EACCES>
+
++Did not have sufficient permissions to determine if AppArmor is enabled.
+
+
+B<aa_find_mountpoint>
+
=item B<ENOMEM>
Insufficient memory was available.
diff --git a/libraries/libapparmor/src/apparmor.h b/libraries/libapparmor/src/apparmor.h
index 903cecd..fbfaae0 100644
--- a/libraries/libapparmor/src/apparmor.h
+++ b/libraries/libapparmor/src/apparmor.h
@@ -21,6 +21,7 @@
__BEGIN_DECLS
/* Prototypes for apparmor state queries */
+extern int aa_is_enabled(void);
extern int aa_find_mountpoint(char **mnt);
/* Prototypes for self directed domain transitions
diff --git a/libraries/libapparmor/src/kernel_interface.c b/libraries/libapparmor/src/kernel_interface.c
index 6a36a54..33fdda9 100644
--- a/libraries/libapparmor/src/kernel_interface.c
+++ b/libraries/libapparmor/src/kernel_interface.c
@@ -29,6 +29,8 @@
#include <stdarg.h>
#include <mntent.h>
+#include "apparmor.h"
+
/* some non-Linux systems do not define a static value */
#ifndef PATH_MAX
# define PATH_MAX 4096
@@ -85,6 +87,50 @@ int aa_find_mountpoint(char **mnt)
return rc;
}
+/**
+ * aa_is_enabled - determine if apparmor is enabled
+ *
+ * Returns: 1 if enabled else reason it is not, or 0 on error
+ *
+ * ENOSYS - no indication apparmor is present in the system
+ * ENOENT - enabled but interface could not be found
+ * ECANCELED - disabled at boot
+ * ENOMEM - out of memory
+ */
+int aa_is_enabled(void)
+{
+ int serrno, fd, rc, size;
+ char buffer[2];
+ char *mnt;
+
+ /* if the interface mountpoint is available apparmor is enabled */
+ rc = aa_find_mountpoint(&mnt);
+ if (rc == 0) {
+ free(mnt);
+ return 1;
+ }
+
+ /* determine why the interface mountpoint isn't available */
+ fd = open("/sys/module/apparmor/parameters/enabled", O_RDONLY);
+ if (fd == -1) {
+ if (errno == ENOENT)
+ errno = ENOSYS;
+ return 0;
+ }
+
+ size = read(fd, &buffer, 2);
+ serrno = errno;
+ close(fd);
+ errno = serrno;
+
+ if (size > 0) {
+ if (buffer[0] == 'Y')
+ errno = ENOENT;
+ else
+ errno = ECANCELED;
+ }
+ return 0;
+}
static inline pid_t aa_gettid(void)
{
diff --git a/libraries/libapparmor/src/libapparmor.map b/libraries/libapparmor/src/libapparmor.map
index df51d01..444278e 100644
--- a/libraries/libapparmor/src/libapparmor.map
+++ b/libraries/libapparmor/src/libapparmor.map
@@ -16,6 +16,7 @@ APPARMOR_1.0 {
APPARMOR_1.1 {
global:
+ aa_is_enabled;
aa_find_mountpoint;
aa_change_hat;
aa_change_hatv;
diff --git a/libraries/libapparmor/swig/SWIG/libapparmor.i b/libraries/libapparmor/swig/SWIG/libapparmor.i
index 1b6b5c7..f0ebf5a 100644
--- a/libraries/libapparmor/swig/SWIG/libapparmor.i
+++ b/libraries/libapparmor/swig/SWIG/libapparmor.i
@@ -13,6 +13,7 @@
* are manually inserted here
*/
+extern int aa_is_enabled(void);
extern int aa_find_mountpoint(char **mnt);
extern int aa_change_hat(const char *subprofile, unsigned long magic_token);
extern int aa_change_profile(const char *profile);
--
1.7.5.4
More information about the AppArmor
mailing list